4 files changed, 20 insertions, 19 deletions

diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 3456cd331835..21f20f21dd32 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -166,7 +166,7 @@ static struct hlist_head *dn_find_list(struct sock *sk)
         if (scp->addr.sdn_flags & SDF_WILD)
                 return hlist_empty(&dn_wild_sk) ? &dn_wild_sk : NULL;
 
-        return &dn_sk_hash[scp->addrloc & DN_SK_HASH_MASK];
+        return &dn_sk_hash[dn_ntohs(scp->addrloc) & DN_SK_HASH_MASK];
 }
 
 /* 
@@ -180,7 +180,7 @@ static int check_port(__le16 port)
         if (port == 0)
                 return -1;
 
-        sk_for_each(sk, node, &dn_sk_hash[port & DN_SK_HASH_MASK]) {
+        sk_for_each(sk, node, &dn_sk_hash[dn_ntohs(port) & DN_SK_HASH_MASK]) {
                 struct dn_scp *scp = DN_SK(sk);
                 if (scp->addrloc == port)
                         return -1;
@@ -194,12 +194,12 @@ static unsigned short port_alloc(struct sock *sk)
 static unsigned short port = 0x2000;
         unsigned short i_port = port;
 
-        while(check_port(++port) != 0) {
+        while(check_port(dn_htons(++port)) != 0) {
                 if (port == i_port)
                         return 0;
         }
 
-        scp->addrloc = port;
+        scp->addrloc = dn_htons(port);
 
         return 1;
 }
@@ -418,7 +418,7 @@ struct sock *dn_find_by_skb(struct sk_buff *skb)
         struct dn_scp *scp;
 
         read_lock(&dn_hash_lock);
-        sk_for_each(sk, node, &dn_sk_hash[cb->dst_port & DN_SK_HASH_MASK]) {
+        sk_for_each(sk, node, &dn_sk_hash[dn_ntohs(cb->dst_port) & DN_SK_HASH_MASK]) {
                 scp = DN_SK(sk);
                 if (cb->src != dn_saddr2dn(&scp->peer))
                         continue;
@@ -1016,13 +1016,14 @@ static void dn_access_copy(struct sk_buff *skb, struct accessdata_dn *acc)
 
 static void dn_user_copy(struct sk_buff *skb, struct optdata_dn *opt)
 {
-        unsigned char *ptr = skb->data;
-        
-        opt->opt_optl   = *ptr++;
-        opt->opt_status = 0;
-        memcpy(opt->opt_data, ptr, opt->opt_optl);
-        skb_pull(skb, dn_ntohs(opt->opt_optl) + 1);
-
+        unsigned char *ptr = skb->data;
+        u16 len = *ptr++; /* yes, it's 8bit on the wire */
+
+        BUG_ON(len > 16); /* we've checked the contents earlier */
+        opt->opt_optl   = dn_htons(len);
+        opt->opt_status = 0;
+        memcpy(opt->opt_data, ptr, len);
+        skb_pull(skb, len + 1);
 }
 
 static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index 72ecc6e62ec4..7683d4f754d2 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -360,9 +360,9 @@ static void dn_nsp_conn_conf(struct sock *sk, struct sk_buff *skb)
                         scp->max_window = decnet_no_fc_max_cwnd;
 
                 if (skb->len > 0) {
-                        unsigned char dlen = *skb->data;
+                        u16 dlen = *skb->data;
                         if ((dlen <= 16) && (dlen <= skb->len)) {
-                                scp->conndata_in.opt_optl = dn_htons((__u16)dlen);
+                                scp->conndata_in.opt_optl = dn_htons(dlen);
                                 memcpy(scp->conndata_in.opt_data, skb->data + 1, dlen);
                         }
                 }
@@ -404,9 +404,9 @@ static void dn_nsp_disc_init(struct sock *sk, struct sk_buff *skb)
         memset(scp->discdata_in.opt_data, 0, 16);
 
         if (skb->len > 0) {
-                unsigned char dlen = *skb->data;
+                u16 dlen = *skb->data;
                 if ((dlen <= 16) && (dlen <= skb->len)) {
-                        scp->discdata_in.opt_optl = dn_htons((__u16)dlen);
+                        scp->discdata_in.opt_optl = dn_htons(dlen);
                         memcpy(scp->discdata_in.opt_data, skb->data + 1, dlen);
                 }
         }
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index c2e21cd89b3c..b342e4e8f5f8 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -526,7 +526,7 @@ void dn_send_conn_conf(struct sock *sk, gfp_t gfp)
         struct nsp_conn_init_msg *msg;
         __u8 len = (__u8)dn_ntohs(scp->conndata_out.opt_optl);
 
-        if ((skb = dn_alloc_skb(sk, 50 + dn_ntohs(scp->conndata_out.opt_optl), gfp)) == NULL)
+        if ((skb = dn_alloc_skb(sk, 50 + len, gfp)) == NULL)
                 return;
 
         msg = (struct nsp_conn_init_msg *)skb_put(skb, sizeof(*msg));
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index 3e0c882c90bf..590e0a72495c 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -124,8 +124,8 @@ static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = {
 static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
         struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
-        u16 daddr = fl->fld_dst;
-        u16 saddr = fl->fld_src;
+        __le16 daddr = fl->fld_dst;
+        __le16 saddr = fl->fld_src;
 
         if (((saddr ^ r->src) & r->srcmask) ||
             ((daddr ^ r->dst) & r->dstmask))